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Sample “Sniffer” Screens 


The following series of screens illustrates just a few of the 
features of the Network General “Sniffer.” They are 
intended to give the reader a flavor of the general features of 
the product by displaying some typical screens used during 
an analysis session. They are all taken from a “live” 
product. 


The entire content of this overview is Copyright 1986 by Network General Corporation. Present copyright law 
protects not only the actual text, but also the "look and feel" of the product screens, as upheld in the Atari and 
Broderbund cases. 
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Additional information is supplied in detail view 
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Also show a hexadecimal view 
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Three synchronized windows 
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Pick a file from a list 
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Full decode of all MAC fields 
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Observe the regular 7 second roll call 
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Link session established 
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Sample Screens 





NETBIOS session established 
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BID 


NET USE followed by "DIR A*" 
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SMB R 1 ent 





capture 


(done ) 


Sample Screens 


Pett teat statel tatatatate ste lalstete stele atetetstetet state! 
i sere prota gretet elevate eter ee F arate tee ete eles 
’ . : anata a g's eee 


Protocol 


een eter e a ate eee etete ees . i ratecctatnter eosetote eos Ssren coe 


5 OOg 
ena a eg ee ee a ee eat e's tag Fae ta et ee ® 
Set tt tal gtatet alah teat stelet rate ataat fatal state state setae 
5 .* ae raat ae ee aie ee 


ee ge ee ar ele 
erate ee are ete 


orate a a ete ee eee 


Mtatatatatatgteteatsetatatetatstetatate a tatetate'statatstate'etatyteta ete ates ate ta ee pee cet a att yee see eh eee ee eee ae ae te ne ae 
ene ea a ea ge ae ee ee gat pe bee tee tog wet eet HET Oe oe wee a et 4 ee oat wg te . Cone eee nee en 
ee eee eee ee ete wit tete wee ell elle elles 
. we ee . Ss . . . wae ete e sate ates 
ete ey ve 


eeettee ser teeeer ere eteatns oe oF 7 o wT eeee eee eee teehee ee ee ee 
a eh eet eee eee eye seh ee eet eee Set eee eet eee eet Ae ThE TNS sere ty sie ay eee tieis sleet ge teee teat eet se eee ees 
wees, . ears eres a ae ee ree eee eee ee eee! 


teen ere ere eet et tatatatatatetatatatetate 
eee a eg ete sete 


re ante a ete arate ote sale a ate a e's sete sais 'p es eis 8 a's 8 e - . . 
Been tee eee oe eetsee cent hate ot cate eae atet ett eae renee ieee esa eet a eee taste eaters lett ore sorrs sats ete eerste 
ROR T I RRREHN A NTR vee ee tte eee see 
ee : vette tenet . 


93. Data 22 eee SS SRE 


5 oe 
oe ee ete ae ea n't a g's ee tee te 
vente eee eels alee let 


Pscastatetatcetatatetet tater atateh telat tater ataletytata’ tater atetatatatetatotat witelstotenes 


. sas 


Fete ee eee ee eee e eee ea ee eee 
re i i a 
atte 


. ee 
weet tele : * erate ete eae a elelel eter ees 
a ere eee ea’ e . sere eretet elena ree . 


ee age ee ee e's 
Se eleye slleeae alae ee eee ee eles eae a ee alee 
5 rete area a te eter ttt tttes te 
ve 
see ee eae etal ele? 


setececerele 
satotet ate eee 
veneer ee tee 


eet eee area atetet ate 


. 
totes etete ere eee ee - . 
eniemere CORDA e UD Cents GUDObOIeU 
Tete tees ae ae eae eee ae sae ‘ete eee eee ’ weeeeeeee tee er ee ee! 
ee ee ee ge egg ta et ee ee et ee tee Ona 
. wee wana eee tte 


oar ty 
ae ee ee ee 


Pete tee ete eee ete Pe tees eee ee ene ee ee eee -&': we ae ee eee 
. ee ee a) Beoide rea Maiden teas cweneraecesss. 


ete a ete e ete a ete a wie . . eae! ote . “ te ae . ve 
eae e eae eae ye Dee hye eet het Fes fee oe 


nteete p lancet sea ceeeetre 


eaten tate ete atetety? 
aren att eee 
. '. 





Show multiple protocols in each frame 
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Aen ee ene e eee ees 
x wate eee ate 
ete 





eee e tees ete tees eee ee 
aie te 


Print the detail view to a file 
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found 





done 


ae a ee ee 


tet e eee 


- 
ee ee ee ee eee ee ee ee ee ee eee ee 


IRR ARIE 
nee ee a ee ee 





9G 





seat teate late 


ocelete ete ele eae! 





weeeeer et tee te ee eee 





eee ee a ge a et eee ee te et ee ee ee 














vee a ey ee a ee 
a ate ate 





eee ee ee ete pee a ee eee ne ee 
Pe ee as 





Sample Screens 


Sniffer data collected on 8/13/86 at 14:08:32, Page 1 


~- 2 - - ee ee ew ew ee ee ee Prame 98 - - ee et ttt tet rts 


DLC: Frame 98 arrived at 14:06:09.229; frame size is 0058 (88 decimal) bytes. 
DLC: AC: Frame priority 0, Reservation priority 0, Monitor count 1 

DLC: FC: LLC frame, PCF attention code: None 

DLC: FS: Addr recognized indicators: 00, Frame copied indicators: 00 

DLC: Destination: Station 1000S5A002FEB, IBM PC #1 


DLC: Source : Station 10005A0033BF, IBM XT/Serv 

DLC: 

LLC: ----- LLC Header ----- 

LLC: 

LLC: DSAP = FO, SSAP = FO, Command, I-frame, N(S) = 3, N(R) = 3 
LLC: 

NET: <---> NETBIOS Data Only Last ----- 

NET: 


NET: Header length = 14, Data length = 56 
NET: Delimiter = EFFF (NETBIOS) 

NET: Command = 16 

NET: Transmit correlator = 0000 

NET: Remote session number = 1 

NET: Local session number = 2 


SMB: Net path (NPID) = 0000 
SMB: Process id (PID) = 0000 


SMB: Return code = 0,0 (OK) 
SMB: File pathname = "\\EAGLE\CDISK" 
SMB: Password = "" 


SMB: Device name = "A:" 


SMB: [Normal end of "SMB Tree Connect Command" packet. ] 
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APPC: #2 0000800000. 
Bodiddly _—_: 48000AS66BEA 


80002008592 





Select a name 


Copyright 1986 Network General Corp. a2" Sample Screens 


POO 
o 5 et terete 5 


5 ee ae 
ae ee eee et eee eee eet eee a et ae tgp tia este ee 
ate a ete ee 
SOUDOOnOUCOODCUROOO OO OCR 
ee ee ee a ee eee ae eg aie eg ea a's 
wee eae eae eee s 


aera ene eet eee 


Sasete es eMirtesctr eis elo naam an rn tretteerariararaseeaetcee 8 
OE a 


=Bodiddly 


oy erate tet arate iatatatelatetatatecateelengeteretet aerate 
ceae eae . 


. 
ate . on *, 
ccatccettiatte slo sare hte sith ecen 
eee 


. 5 
anata a etal a ele alate ete 


eee ate 
. ee eee te ete! ete 
oes ene a et ee eta ee 


ares’ 
ana en ete tg tt e'etetalete aly sleet ees 
net! 


wee 
ere age! 
0 eee ee ae 


se ete eee ee ee 
| ore see one ate ee ate ate ate 
° . tte a ate a ates ote es aie e ote e 
ee ee ry 


. ooo’ weet ete eel e ee ete ate 
eee ea ee eae a et ee te ee ee ee et eet wet wee ee ate a ate ea ea ey 





Add, delete or modify a name 


tet tatet atat latel ale satatslatattatel tatetale stetelatatet st atetstetet tatet staat e eee ee eee ee ee et eee ee ep eee eee nee 
5 . ee nate rate ee nae tet Late tate ate 


eee ea eee ewe 
ete ete arate 


Tt eae ee ee ae ees eee 
eee test ese ee? 
tree eter a ote! 


-14-86 17:18 


SAA aetete gta poeta’ atatatt Te gee tetete tet ate slept eget! 


20: ee 


atte one! 


DOr ra . . 1g anata ne oie e ate ere eee 
wees eee eee set ett! 
eae as! oo ae 


viata gta ate ete ee a ee gg eae te 
Nccatetce eteatetate'e BOO aa at ate ete e's 


*, GOOG . 
wate a ee ete gt ele tie a ties tnt bg et eet eye eet es 
* ee 


OE tenet Talal tatatgtsletstetet ste 
ea ate ae . 


aig ee sie ge tele tee tap tee tee te tt ee 
ete eee oan aaa’ 


erect ttt atet tat 

< ean eet ate 5 

ee ee et eet et ane eet ee * . ee eg ee pt eet wat eet eat eet set eet ee 
vara eat tet tatetet 2 os o- Oo 


veer ietatattatetatatelt ates 


e’e eee tee teat pete e® 
ey aaa . . eae eae a a een e 
nena eae are gis e's O a’ ee ee ea ye 





Sample of IBM APPC/PC (LU6.2) data 
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f 


WS profile flags = 07 


Prima LU rotocol flags 





Summary and detail of SNA frames 
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Sniffer data collected on 8/14/86 at 17:18:50, Page 1 


Copyright 


Format identification (FID) = 2 


Transmission header flags = 2D 
0010 .... = Format identification is type 2 
~ooe L1.. = Only segment 
eeee --O. = Address field negotiation flag 
eecoe eoel = Expedited flow 

Reserved = 00 

Destination address field = 01 

Origin address field = 01 

Sequence number = 12 


----- SNA Response Header (RH) ----- 


Response flag byte 0 EB 
1... .... = Response 
-l1l. .... = RU category is ’session control’ 
~--0 .-.. = Reserved 
eoee Ll... = Format indicator 
.-o- -O.. = Sense data not included 
eeee «ell = Only RU in chain 
Response flag byte 1 = 80 
1... .... = Definite response 1 indicator 
-O.. «ee. = Reserved 
..O. .... = Definite response 2 indicator 
~--0 .... = This is a request RU 
---- OO... = Reserved 
wee --O. = Response bypasses TC queues 
wees eee 0 = NOt a pacing response 
Response flag byte 2 = 00 
0000 0000 = Reserved 


----- SNA SC-RU (Session Control Response Unit) ----- 


SC code = 31 (BIND: Bind Session) 
Format/type flags = 00 
FM profile flags = 13 
TS profile flags = 07 


Primary LU protocol flags = BO 
1... .... = Multiple RU chains allowed from primary LU 
.O.. .... = Immediate request mode 
..11 .... = Chain response protocol 
1986 Network General Corp. =29> Sample Screens 


SNA: 
SNA: 
SNA: 
SNA: 
SNA: 
SNA: 
SNA: 
SNA: 
SNA: 
SNA: 
SNA: 
SNA: 
SNA: 
SNA: 
SNA3: 
SNA: 


ose «0. = Compression will not be used 
eoee «--O0 = Primary LU may send End Bracket 


Secondary LU protocol flags = BO 

Common LU protocol flags #1 = DO 

Common LU protocol flags #2 = Al 

TS usage flags #1 = 02 

TS usage flags #2 = 02 

Maximum RU size sent by secondary LU = 85 
Maximum RU size sent by primary LU = 85 
Flags #1 = 82 

Flags #2 = 02 

LU type = 6.2 

(28791 bytes of LU data] 


{Normal end of "SNA SC-RU (Session Control Response Unit)" frame. ] 
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Sample Screens 


0000 20.40 40 00 00 90 00 02 





Side-by-side comparisons 
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Ame: 
n 


i 





Percent usage of total bandwidth shown 


Copyright 1986 Network General Corp. -28- Sample Screens 


eee eee ete a a ae eae ey ee aie tgs 
retatatetctaresetarangtg et atate ole aleter eres aes 


eee ee ete eee tee tig et ete wee eee eet we tek tee ae teat get eet eet eet eee wee ett eet 
stat datatacetetatetetcitaretatete 


oe ot ate ate! ote 
ar anaret ate t grate states gate gl alate etelalete 
vate ete e . ate a ate a 


wee eae ale 
rere tel 


. 


Search for frame 


gag tee eae a ae aah ee a eee le see a eee 
ater - 

ue 
eae tee at 


eae eg ee 
eect tata tateltatatetetetateetat etal state! 
.' see eee 
. ete 


eee tee 
ete a ea tete gt ate et et ete 


eter e Toe e TCE OT ETC TES PERS TT te 
eee toe rece eotaseeetoeian®? 

steele 

ett e's 


vote et eet eet ee? 
woes sree ee ees 


wate a ate a ates 
nae ete tetas 


.' 
vate a ate ate . 
ee ee ee ea eg ee gee rate ee eg ee e's 


. ne Serie 


. vere Pete eee ote 
eee ee ale ee ae eee ete e eee see ' O cetera tere eerste 
ane arene 


ete a ae eo" 
eae eee 


Cee ee 
one ete 


eee eee eee ee te ee ee eee eee wee ee eee tt at setae 
Re ee Re 

ate tatatatstetetateteatatetstatetatatetgtatet anata’ 

. . ss 


a eee 
eet alate atetete! 


en aret eat y 
et etetetg ate atetete etl ateleagtela'sis e'e tt eles atet gs teat te? 


. ‘ ere pe eee. 
eee erate tee a 
scence ane ale a eee etme nt et 


’ Tae e ates a a tee a ate ee eee ees 
wre nanan eater a alee! 
ane are ae a te 


. eaters ayer ele le 
ene se ate ee ete eee tee eee tee te 
Sate eratevat stellate etetevetete etste'e 


OO 


. S . oe 
at eghocletatatecattestite rtcegelc ranean CUM Ces ReS RAS OS ANON T Sera Cee N een Sm NSNS 
“ * . * 


wt tatatetet 
ae a a ate eat 


Set ete Peete TEE SHES ST TRS E ET TH POE AST Oe eee ee eee eae EC 
eee . re rere ate ee ees 


wf, ’ 
wate ate ate ees . . . . . ate a ate a ate a ate eo ete sate a ate eles gis a pte we ee 
eee eee ee eae Hes tee hee tee tee net ’ eg eee ee ee ang eg ee ea ee ge rag eet e sete ye eas 


Sie ainiot steelers saree apiece hee aren breierecotrapictestceptsan 


eee e rere eater aerate 
Meletceletretetotctartetetetetslssites oe! 
wate ates als 
5 


we eleles 





ea ae ea ate ete a ga, 





Find via a pattern match 
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XNS in summary view 
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Tete tatetet el 
BOO IO 


ane anata ag 
eee ae eter ee 


Seteee ee eet gets eee eer as s wae 
eae a ea a a ga a ae eg ee 

sere 

. 


fe . . wate 


Son 
eee eg ee eee a ee ee tess we tee tae tee 
orate talatatchatatatetstatetatee’ shel 

nate a erate ate” state 


SOOO On 
sale eee eee ate eee ea a eles e's 


. . 
ora ee a ee ee ‘tee e reese 
eee ee eee e. 

ott 


Novell NetWare 


ate ete ae 
eels 


satan tataratutatatatatcerat ceeroeatarat sresnverereratetieareetersrenes 

erate ten aren ate tet lets etet a erent etet st atet stele 

OO a oar are ate a ate a ale ela ete fea ate ee 
ee estate 5 eles eee nae! : 

ee eee ea ee a ete ee tale ae alee pete ate a ate e eae ate pe ee 


Pete et ete eae eae eae ee eee ee ene eee eee ee COOOOUUUUOOO OO EE RE Ee EE 
toe ag eg ete yg telat get eee ge ag ea ee age aig te ee : ee ee ag ae eet ee tig et ae ® 
eet eee a ale wee gee ® oe sheet tetatetee! . 
erat ete . esas 5 . ere ate te ete 


ere ete ae rate arate a ae a ety 
are aet er ele te eletet elena feet alee 


RE EE ED 
Hoe nen ieee ae ae alee ale eee el aes 
wale elle ele stele eles 
arena ate tet . 


. eatatet state tanen ate tetatetg tate 
see ete le etee ee ret ltete 


a ate eae 
ee ge ee eg ee ee tae tp et eet bet at eee gat a ete et 
estat taht tate tact cetateletatatetgtetet at etet satel 





eee . < 
ee ea a eee aa eee ete e 





oe tote aee te! oe Moetatete? 
ror a Ss . 5 ‘ ~ we ne etetay , cele alee wate 
sea eee tata Tet alate as 














ere tate tee i 
rar etetatatat gt atat satel staat atetetet are ate et atatel arate t eae 
ate gate ate ete ee . 





TW Cc crane JIM 


*, . . ofa ES 
et eet eet eet eee es eee eee eee Ete a a a ete ea ee a a eel tig et ee 





arate et ee eats ag ee ate . 
eae eae eae a a ete ee eee ete eae alee + 
sent leit ey 











. . . : 
arate grote een atet eaten greet alate eters tat etet 
en ate ee . pie . ee 

eae ale eee 8 cet pe ele tae tele ee gt eet 











Settee a a eta stat atatatg yah ts tatatstatate’s atatetatatetatetetatetstatats tg’ ptetatatetatyttetetet ate etetatete yee 
Oo one a ee ent oe eee ee ee ee Be eee wet ee Cer ODT EDT OED ODM ERPS RT ENT BES Cee a 
“s Hf ete Partatatatetstacetatatetetateat ote’ anstere'e 


LETTE ES ttt TE Tt tA tee ee ee see eae eae ae ee, eee ete 
. ge a a se eet ee Secstdlestes eee SESE USRERAS NEUES NS 
ea ee eats . . 

Conn 


ret eteret erates 
ve 


ett tt te eate et tatet stat 
or rate’ 


OOO * eee ee ee 
ereleletele se eleletelelet eet ne tee tet at, . x f° 


ae ee a a a ete eta ee a a ee ee ag a a ee eee a a wat 


72 Set 


Help 


Novell NetWare in summary and detail views 
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eee tee hee t eet eet eet eee eet eet es 
ones 


Protocol 


teeth fateh tetet te eats 


9.287 Nestar FSS 


teens nee, AOS et et ee oe een ee eee ne eee ee eee ene ee ee ae ee a ae ae 
.*." . 


oe nee ee 
ane 


nate state 


wideletetes 


e GOOGOOOE 


eee scot cet eeroerenecetase eet eveee®s ene"e's cae ce eoee cee 


Nestar PLAN Series in summary and detail views 
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. 


ate eee a ee eee a ge eg ee eg ge ale ee ee 


eae e 


One eee eee ee ee ene eee ee ee eee 
. tere 


At telel tate sttellaletaletetatetetatatetstatatstetety! 
. : 


Z(§0D> 


oe eee ee eee 





ae tea eae ea a ea geese 


Teese TET ETN See eee Ee See bee eee tte 
Snes eee oes 
aoe ee en eee renee aerate . 
eat eae eae eat ee ele, 


. 
ate e eee eee 


Sample Screens 


Fe te ett ate tate Pater tate tate® 
5 fe are rane ae ae 8 


PERERA ee ee ee 
ete terete gee ee ". 


See tee et tte eee et eee et ee ee ee 8 oe 
’ . . 


. '. 
ete a ae a gel 
aie eee see 


ae ate a ee eters 


a eee eels . se 
ee eee se ee tet 
rane ate eet e a ete erate a 

area et ete ee etal e arate erate ete eee eet ete te eee atg ee ere eee * oe 5 rates! 

arate gate ate le ere eee tie tt tot ee te et eet eet ee 0 oe . tere a ee ag ea ee alate get ys 8 ele tale tee te et eet 
ee . at eae! . Se) rs . y m eet ate eae ete arate a ete eter a alate eter e ote! oar ate a ate 


rele ele elle 


OC . OO 
. ene e ene ee gig a eet : . . . eee treet cee sees et eet eet ue ty 
. ee ee ate a ete eiele eters ely a # 

5 ote greta eho ates Fate oo 


. 
. 


ae area eters pee eee te ee 
a aera a enn ate atare rete tal alate etal’ 


we ate ae 
eae tee 


Tete e t ete et eee te ee ee tae ee ete eee eee EEE eae Cae eae 5 esas eee eet et te tee ee eee e espe twee ea ee 

oe ogee a ee a gt get ne tee t wet set oes age opt eet bet ge te et ae . ea ga ga a a ge 
artes 5 . es atitee eee ees 0 

fs . 


eae ane ae gate ae 
rae ate a aes a ate sate 8 ote e 


'. ele aera ahaa tet ate ea tet ate te eee! , ve 
neta ee a yt pete et Deh ent eee eee eee eet Dee eet get see eee pet eet tet 
. eee sees nee 
eee te ete ae eels! 


ee eae a eee at ete ate a ere a te ete *, 
eae eee a ee a eae a ee et a a te ee get gg ta gt eet eet wat eet eet eet eet wet ees wet oa # 
ee ene ere ee ee ee ne atte alate alates eels elle else elas 





Copyright 1986 Network General Corp. “337 Sample Screens 





